Chinese-Speaking Threat Actor Exploits ownCloud, LiteSpeed Cache Vulnerabilities to Target Philippine Nuclear, Naval Entities

Introduction

In a recent and alarming cybersecurity incident, a Chinese-speaking threat actor successfully compromised a Philippine nuclear research agency and a naval contractor, exploiting critical vulnerabilities in their systems. The attack leveraged CVE-2023-49105 (ownCloud) and CVE-2024-28000 (LiteSpeed Cache), highlighting the risks of weak default configurations and custom algorithm implementations.

The Attack Breakdown

• CVE-2023-49105 (ownCloud): This flaw allows an attacker to forge pre-signed WebDAV URLs when the signing secret is empty—a default setting in fresh installations. The attacker deployed five custom Python scripts that exploited this weakness. Here’s how it worked:

• The signing routine passed an empty bytes literal as the PBKDF2 salt, effectively bypassing cryptographic protection.

• The OC-Credential header was set to the account being impersonated, allowing the attacker to issue GET requests against /remote.php/dav/files/<account>/<path>.

• The server responded by delivering files as the targeted user, without requiring credentials.

• Four scripts targeted specific accounts, while the fifth added PROPFIND enumeration to map folder structures.

• CVE-2024-28000 (LiteSpeed Cache): The naval contractor was compromised via a custom Go reimplementation of the MT19937 algorithm, designed to mimic PHP’s mt_rand() function. The attacker verified the implementation against 111 known seed/output pairs, ensuring reliability. Additionally, an XML-RPC brute-force attack using the rockyou.txt password list granted unauthorized access independently.

The Broader Implications

This incident is not an isolated event but part of a larger trend of state-sponsored cyber espionage targeting Southeast Asian nations. The choice of victims—a nuclear research agency and a naval contractor—underscores the geopolitical stakes. If left unaddressed, these attacks could:

• Compromise national security by exposing sensitive nuclear and naval data.
• Embolden further cyber aggression against critical infrastructure in the Philippines and beyond.
• Exploit weak default configurations, such as ownCloud’s empty signing secret, which acts as a systemic vulnerability across organizations.

The Hidden Layers

During the investigation, Hunt.io also discovered a separate EtherHiding compromise on the same WordPress site, potentially unrelated to the primary attack. A HuntSQL query on the smart contract address revealed 174 unique IPs hosting compromised pages with identical NoChain loader strings, indicating a broader infection landscape.

This incident serves as a stark reminder of the escalating cyber threats facing Southeast Asia and the immediate need for global collaboration to address vulnerabilities in widely used software systems. The full technical writeup, including IOCs, the signing routine, and MITRE mapping, is available at Hunt.io’s blog.

Attack Methodology

A suspected Chinese-speaking threat actor executed a multi-stage, highly sophisticated campaign targeting critical vulnerabilities in ownCloud and LiteSpeed Cache. By exploiting weak default configurations and deploying custom tools, the actor gained unauthorized access to sensitive systems within a Philippine nuclear research agency and a naval contractor. The following analysis dissects the tactics, techniques, and procedures (TTPs) employed, highlighting the technical precision and strategic intent behind these attacks.

Exploitation of ownCloud (CVE-2023-49105)

The threat actor targeted CVE-2023-49105, a critical vulnerability in ownCloud stemming from the default absence of a signing secret in new installations. This flaw enables adversaries to forge pre-signed WebDAV URLs, effectively bypassing cryptographic protections. The attack sequence unfolded as follows:

• Exploitation of Default Configuration: ownCloud’s default empty signing secret disabled a critical security mechanism, allowing the attacker to manipulate WebDAV URLs without valid credentials. This misconfiguration served as the initial entry point.
• Custom Python Exploitation Framework: The attacker deployed five bespoke Python scripts to exploit the vulnerability. These scripts:
  • Passed an empty bytes literal as the PBKDF2 salt, neutralizing the cryptographic hash function’s effectiveness.
  • Set the OC-Credential header to impersonate specific user accounts, bypassing authentication checks.
  • Issued GET requests to the endpoint /remote.php/dav/files//, exfiltrating files under the impersonated user’s privileges.
• PROPFIND-Based Reconnaissance: One script employed PROPFIND requests with Depth: 1 to enumerate unmapped folder structures, enabling systematic data exfiltration beyond pre-identified directories.

Exploitation of LiteSpeed Cache (CVE-2024-28000)

The naval contractor was targeted via CVE-2024-28000 in LiteSpeed Cache. The attacker developed a custom Go implementation of the MT19937 algorithm, replicating PHP’s mt_rand() function to predict and manipulate seed values. The attack proceeded as follows:

• Algorithmic Replication: The Go implementation of MT19937 mirrored PHP’s random number generator, enabling the attacker to predict seed values used in LiteSpeed Cache’s session management.
• Validation Against Known Pairs: The implementation was validated against 11 known seed/output pairs, ensuring its accuracy in replicating the original algorithm’s behavior.
• Hybrid Exploitation with XML-RPC: The MT19937 exploit was combined with an XML-RPC brute-force attack, leveraging the rockyou.txt password list to gain unauthorized access to administrative interfaces.

EtherHiding Compromise (Unrelated)

A separate, potentially unrelated compromise was identified on the same WordPress site, involving EtherHiding. This attack utilized a NoChain loader to infect web pages. Analysis via HuntSQL revealed:

• Widespread Infection: 174 unique IPs hosted compromised pages containing identical NoChain loader strings, indicating a large-scale malware distribution campaign.

Causal Mechanisms and Risk Amplification

The success of these attacks is attributable to the following interrelated causal mechanisms:

• Systemic Misconfigurations: ownCloud’s empty signing secret and LiteSpeed Cache’s predictable random number generation created exploitable entry points, underscoring the risks of insecure defaults.
• Advanced Custom Tooling: The attacker’s use of bespoke Python and Go scripts demonstrated a high degree of technical sophistication, enabling precise exploitation of identified weaknesses.
• Reconnaissance and Access Techniques: PROPFIND enumeration and XML-RPC brute force attacks facilitated unauthorized access and comprehensive data exfiltration, amplifying the impact of the initial breaches.
• Scalable Malware Distribution: The EtherHiding campaign highlighted the attacker’s capability to orchestrate large-scale infections, increasing the risk of collateral damage and further breaches.

If unmitigated, these mechanisms pose a direct threat to national security, potentially exposing sensitive nuclear and naval data and emboldening state-sponsored cyber aggression against critical infrastructure.

Strategic Implications and Mitigation

This incident underscores the urgent need for the following measures:

• Secure-by-Design Principles: Software vendors must prioritize secure default configurations to eliminate systemic vulnerabilities at the development stage.
• Aggressive Patch Management: Organizations must adopt proactive vulnerability management programs, prioritizing patches for critical vulnerabilities such as CVE-2023-49105 and CVE-2024-28000.
• Behavioral Threat Detection: Deployment of advanced monitoring solutions capable of detecting anomalous behavior, such as unauthorized PROPFIND requests or XML-RPC brute force attempts, is essential for early threat identification.
• Geopolitical Collaboration: Addressing the escalating cyber threats in Southeast Asia requires international cooperation, including information sharing and joint defensive initiatives to secure critical infrastructure.

For a comprehensive technical analysis, including indicators of compromise (IOCs), cryptographic signing routines, and MITRE ATT&CK mappings, refer to the Hunt.io blog post.

Impact and Implications

The compromise of a Philippine nuclear research agency and naval contractor by a suspected Chinese-speaking threat actor underscores a critical escalation in cyber threats to national security. By exploiting CVE-2023-49105 in ownCloud and CVE-2024-28000 in LiteSpeed Cache, the attackers systematically dismantled cryptographic and access control mechanisms, enabling unauthorized access to sensitive systems. This incident highlights the urgent need for enhanced cybersecurity measures in critical infrastructure.

In the ownCloud exploit, the empty signing secret vulnerability served as a master key, circumventing the WebDAV URL signing process. This allowed the attacker to forge pre-signed URLs, effectively impersonating legitimate users. Concurrently, the PBKDF2 salt, a critical component in password hashing, was neutralized by passing an empty bytes literal, rendering cryptographic protections ineffective. The OC-Credential header was then manipulated to impersonate specific accounts, enabling unauthorized file retrieval via HTTP GET requests. This sequence of actions not only exposed sensitive data but also compromised the authentication framework, transforming a secure system into a vulnerable asset.

The LiteSpeed Cache exploit demonstrated comparable sophistication. The attacker employed a custom Go reimplementation of the MT19937 algorithm to replicate PHP’s mt_rand() function, enabling precise prediction of session seed values. This compromised the randomness essential for secure session management, facilitating unauthorized access. Coupled with an XML-RPC brute-force attack leveraging the rockyou.txt wordlist, the attacker gained administrative privileges, significantly expanding their operational foothold within the targeted systems.

The broader implications are profound. The EtherHiding compromise, while unrelated, exposed a scalable malware distribution network that infected 174 unique IPs via compromised WordPress pages. This underscores a systemic failure in detecting and mitigating large-scale cyber infections, amplifying the risk of cascading breaches across interconnected systems.

National security is directly imperiled. The exposure of nuclear and naval data could compromise operational integrity, providing adversaries with actionable intelligence to exploit vulnerabilities in critical infrastructure. The geopolitical context—targeting Southeast Asian nations—aligns with a broader pattern of state-sponsored cyber espionage, positioning the Philippines as a strategic target within regional power dynamics.

The causal chain is unequivocal: misconfigured default settings created exploitable entry points, customized attack tools enabled precise exploitation, and advanced reconnaissance techniques amplified access. Without immediate and comprehensive mitigation, these mechanisms will escalate cyber aggression, threatening not only the Philippines but the entire region. This incident serves as a critical wake-up call for global cybersecurity collaboration, emphasizing the imperative of proactive defense in safeguarding critical infrastructure.

Response and Mitigation

The cyberattacks targeting the Philippine nuclear research agency and naval contractor prompted a comprehensive, multi-tiered response aimed at containment, forensic analysis, and long-term resilience. The following measures were executed with precision, grounded in the technical exploitation vectors and causal mechanisms identified during the investigation.

Immediate Incident Response

Upon breach detection, the affected organizations initiated the following technical actions:

• Network Isolation: Compromised servers running ownCloud and LiteSpeed Cache were isolated via network segmentation. This involved disabling network interfaces and firewall rules, effectively severing external communication pathways to halt data exfiltration and prevent lateral movement.
• Forensic Preservation: Live memory captures and disk imaging were performed using forensic tools to preserve volatile artifacts. This process included freezing system states to retain active processes, network connections, and registry entries, enabling reconstruction of the attack chain.
• Vulnerability Patching: Critical patches addressing CVE-2023-49105 (ownCloud) and CVE-2024-28000 (LiteSpeed Cache) were deployed. The patching process replaced exploitable code segments with hardened versions, neutralizing the identified vulnerabilities at their source.

Root Cause Remediation

Addressing the underlying technical vulnerabilities required targeted interventions:

• ownCloud Configuration Hardening: The default empty signing secret was replaced with a 256-bit cryptographically secure token, generated via a hardware security module (HSM). This rendered pre-signed URL forgery computationally infeasible, closing the primary exploitation vector.
• LiteSpeed Cache Cryptographic Upgrade: The MT19937 pseudorandom number generator (PRNG) was replaced with a FIPS 140-2 compliant CSPRNG implemented in Go. This eliminated session seed predictability, thwarting brute-force attacks against session tokens.
• Brute Force Countermeasures: XML-RPC endpoints were fortified with exponential backoff rate-limiting and IP-based blocking. This involved integrating a machine learning-driven anomaly detection module to identify and mitigate credential stuffing attempts in real time.

Proactive Defense Enhancements

To establish long-term resilience, the organizations implemented the following measures:

• Configuration Hardening Framework: A standardized secure baseline configuration was enforced across all critical systems, incorporating CIS benchmarks and NIST SP 800-123 guidelines. This included automated compliance monitoring via configuration management tools.
• Threat Detection Architecture: A layered detection capability was deployed, comprising network-based IDS sensors, endpoint detection and response (EDR) agents, and a SIEM platform with threat intelligence feeds. This enabled correlation of PROPFIND anomalies and XML-RPC attack patterns.
• Continuous Penetration Testing: A red team/blue team exercise program was instituted, with quarterly simulations targeting critical assets. This involved leveraging MITRE ATT&CK frameworks to emulate advanced persistent threat (APT) tradecraft and validate defensive controls.

Strategic Implications and Geopolitical Context

The incident reflects a broader pattern of state-sponsored cyber espionage targeting Southeast Asian critical infrastructure. The following strategic initiatives were undertaken:

• International Cyber Defense Alliances: The Philippine government formalized information-sharing agreements with ASEAN cybersecurity centers and NATO’s Cooperative Cyber Defence Centre of Excellence (CCDCOE). This established structured threat intelligence exchange mechanisms.
• Regulatory Framework Modernization: Amendments to the Philippine Cybersecurity Act were proposed, mandating ISO/IEC 27001 compliance for critical infrastructure operators and establishing a national vulnerability database (NVD) mirroring system.
• Public-Private Cyber Resilience Consortium: A joint initiative between government agencies, academia, and private sector entities was launched to develop indigenous cybersecurity capabilities. This includes a national cyber range for simulated warfare exercises and a scholarship program for offensive security specialists.

Persistent Risk Mitigation Strategies

Despite remediation efforts, residual risks remain due to the following factors:

• Zero-Day Exploitation: Undiscovered vulnerabilities in widely deployed software create persistent attack surfaces. This is mitigated through binary hardening, control flow integrity (CFI) enforcement, and participation in global vulnerability reward programs.
• APT Adaptability: State-sponsored actors continuously evolve tactics to bypass defenses. Countermeasures include threat hunting operations leveraging behavioral analytics and integration of deception technologies to misdirect adversaries.
• Insider Risk and Human Factors: Misconfigurations and credential compromise remain significant vectors. Addressing this requires mandatory security certifications for IT personnel, privileged access management (PAM) systems, and behavioral monitoring of high-risk users.

Through these technical, operational, and strategic interventions, the affected organizations and national authorities aim to establish a resilient cybersecurity posture capable of withstanding sophisticated threats. The incident underscores the imperative for continuous innovation, international cooperation, and proactive threat modeling in safeguarding critical infrastructure against state-sponsored cyber aggression.

Broader Context and Geopolitical Ramifications

The recent cyberattacks targeting a Philippine nuclear research agency and a naval contractor, attributed to a suspected Chinese-speaking threat actor, represent a calculated escalation in state-sponsored cyber espionage. These incidents are not isolated but form part of a strategic campaign against Southeast Asian nations, leveraging critical vulnerabilities in key institutions to advance geopolitical objectives. This analysis situates the attacks within their regional and global context, elucidating the mechanisms and strategic implications driving this trend.

Regional Cybersecurity Landscape: Southeast Asia as a Strategic Target

Southeast Asia’s geopolitical significance, economic growth, and critical infrastructure vulnerabilities have made it a focal point for cyber espionage and state-sponsored attacks. The Philippines, positioned at the nexus of regional power struggles—particularly the South China Sea territorial disputes—presents high-value targets for adversaries seeking intelligence or operational disruption.

• Geopolitical Tensions: China’s assertive territorial claims in the South China Sea have heightened regional friction. Cyberattacks offer a low-risk, high-impact mechanism to undermine adversaries without triggering direct military confrontation, aligning with hybrid warfare strategies.
• Critical Infrastructure Exposure: Southeast Asian nations, including the Philippines, often rely on legacy systems and lack comprehensive cybersecurity frameworks. This creates systemic vulnerabilities in sectors such as energy, defense, and nuclear research, which threat actors exploit to gain persistent access.
• State-Sponsored Sophistication: The attacks’ technical complexity—including custom Python and Go scripts—aligns with the capabilities of state-sponsored groups. These actors systematically exploit unpatched vulnerabilities and misconfigurations, as demonstrated in the ownCloud and LiteSpeed Cache incidents, to achieve strategic objectives.

Mechanisms of Risk Formation in Critical Infrastructure

The attacks on Philippine entities exemplify how software vulnerabilities and configuration weaknesses create cascading risks. The causal chain is as follows:

• Root Cause: Unpatched vulnerabilities (CVE-2023-49105 in ownCloud, CVE-2024-28000 in LiteSpeed Cache) and insecure default configurations enabled initial exploitation.
• Internal Process:
  • ownCloud Exploit (CVE-2023-49105): The absence of a signing secret in ownCloud’s default configuration disabled cryptographic protections. The threat actor used custom Python scripts to forge pre-signed WebDAV URLs, bypassing authentication and exfiltrating data via HTTP GET requests.
  • LiteSpeed Cache Exploit (CVE-2024-28000): A custom Go reimplementation of the MT19937 algorithm predicted PHP’s mt_rand() session seed values, compromising session randomness. Combined with an XML-RPC brute-force attack, this granted unauthorized administrative access.
• Observable Effect: Unauthorized access to sensitive systems, data exfiltration, and potential disruption of critical operations, directly threatening national security and operational integrity.

Strategic Implications: Beyond the Philippines

These attacks signal a broader trend of cyber aggression against Southeast Asian nations, leveraging replicable mechanisms—unpatched vulnerabilities, weak configurations, and advanced tooling. This raises critical strategic concerns:

• Escalation of Cyber Conflict: Unaddressed, such attacks may embolden adversaries to target additional critical infrastructure, including energy grids, transportation systems, and financial institutions, amplifying regional instability.
• Intelligence Gathering: Access to nuclear and naval data provides adversaries with actionable intelligence, potentially shifting the balance of power in regional disputes and undermining deterrence capabilities.
• Erosion of Trust: Repeated breaches erode public and international confidence in Southeast Asian nations’ ability to secure critical infrastructure, hindering foreign investment and technological advancement.

Practical Mitigation Strategies

Mitigating these threats requires a holistic approach, integrating technical, regulatory, and geopolitical measures:

• Secure-by-Design Software: Developers must enforce secure default configurations and prioritize proactive vulnerability patching. For instance, ownCloud could have mitigated the exploit by mandating a non-empty signing secret during installation.
• Advanced Threat Detection: Deployment of SIEM tools and anomaly detection systems can identify unauthorized PROPFIND requests or XML-RPC brute-force attempts in real time, enabling swift response.
• International Collaboration: Formalized threat intelligence sharing agreements, such as ASEAN’s Cybersecurity Cooperation, are essential. Collaboration with global entities like NATO CCDCOE can enhance collective defense capabilities.
• Regulatory Modernization: Mandating compliance with standards like ISO/IEC 27001 and establishing national vulnerability databases can enforce baseline security practices across critical infrastructure sectors.

Edge-Case Analysis: The EtherHiding Compromise

The concurrent discovery of an EtherHiding compromise on the same WordPress site underscores the scalability of malware distribution networks. This edge case highlights the risk of cascading breaches:

• Mechanism: The NoChain loader propagated malware to 174 unique IPs via compromised WordPress pages, demonstrating a large-scale distribution campaign.
• Risk Formation: Failure to detect and mitigate this compromise allowed the malware to propagate, expanding the attack surface for further exploitation.
• Practical Insight: Organizations must implement continuous monitoring of web assets and deploy tools to detect anomalous behavior, such as unauthorized script injections or unusual network traffic patterns.

Conclusion: A Call for Urgent Action

The attacks on Philippine nuclear and naval entities underscore the escalating cyber threats facing Southeast Asia. The confluence of technical sophistication and systemic vulnerabilities creates a critical nexus of risk. Addressing these challenges demands technical hardening, regulatory modernization, and international collaboration. Inaction will not only compromise national security but also embolden adversaries to target critical infrastructure globally. Proactive defense is imperative.